9ce9e29e5fab67f85bf6f2d75f618351ae0bea3c7526d92f276de4905093943c

Analysis

max time kernel
147s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/06/2026, 01:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-27_f8f89129321867726c757673a6b07d79_icedid_stealc_vidar.exe
Size 748KB
Sample260629-bjasvaa17q
SHA256 9ce9e29e5fab67f85bf6f2d75f618351ae0bea3c7526d92f276de4905093943c
MD5 f8f89129321867726c757673a6b07d79
SHA1 d929eec34c16e9abdce2bb68d6d93a6df9ba8cba
SHA512 433bb1eff3f35dc001c20f75c2518a623f22324c2898de8142b98f0c7fb14c577d601493ef230471b955723ea6193e3264c6cd79500f306f2cc2f913c0cf2e62
SSDEEP 12288:HRD7ms2T9lJ4or2Zcb7WLAlZxbEX9xq79m5h8jthoZ1gpAStyEeUDNpmV7cluTOG:HRWs25lJ4qsMamZxbsIgkj8KAoeU5pmR
TLSH
T122F4124BB2EA21F9E077953AC861490AFB36B97513319F3F02644372DF272619D16F22
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 9 IoCs

pid	Process
3896	alg.exe
5336	elevation_service.exe
1992	elevation_service.exe
1856	maintenanceservice.exe
5504	OSE.EXE
4416	GameInputSvc.exe
4480	GameInputSvc.exe
2292	msdtc.exe
2108	PerceptionSimulationService.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 10 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\alg.exe	2026-06-27_f8f89129321867726c757673a6b07d79_icedid_stealc_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\5dd1b58ac353a95d.bin	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-06-27_f8f89129321867726c757673a6b07d79_icedid_stealc_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	alg.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_100640\java.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	alg.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	GameInputSvc.exe

Modifies data under HKEY_USERS 41 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4480	GameInputSvc.exe
4480	GameInputSvc.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	480	2026-06-27_f8f89129321867726c757673a6b07d79_icedid_stealc_vidar.exe
Token: SeDebugPrivilege	3896	alg.exe
Token: SeDebugPrivilege	3896	alg.exe
Token: SeTakeOwnershipPrivilege	5336	elevation_service.exe
Token: SeTcbPrivilege	4416	GameInputSvc.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4416 wrote to memory of 4480	4416	GameInputSvc.exe	96

C:\Users\Admin\AppData\Local\Temp\2026-06-27_f8f89129321867726c757673a6b07d79_icedid_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-27_f8f89129321867726c757673a6b07d79_icedid_stealc_vidar.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:480

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:3896

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:5336

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1992

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:1856

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5504

C:\Windows\System32\GameInputSvc.exe
C:\Windows\System32\GameInputSvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4416
- C:\Windows\System32\GameInputSvc.exe
  "C:\Windows\System32\GameInputSvc.exe" Global\GameInputSession_1
  2⤵
  - Executes dropped EXE
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:4480

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:2292

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2108

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
PID:4600

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
PID:2800

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
PID:5172

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 1138d2648d4e66493dc778fa1112760945781df53e61cb4b75ba2090a8103d80
MD5 45a83062772901044eaf7c35cfddf80d
SHA1 1b00d4684efc674ede8ba196b4bfc83ec517ec88
SHA512 03dc5cdb4a1fa7d9861f0f9e942e5747e572042e0043f2f5eb66dba1f167dc848012c84e2543dcff7b032d8c23f2e370a526376019429f649a989f40d9a894bf
SSDEEP 49152:QwR632BuPkFKRrdE6oh7stBhuXjfS4LWxnHM5xbKkj8rBGGAh7:s3q6gjBHhg0GAB
TLSH
T1C3D59D03F29900E9E06AD178D7469133EAA2BC890B34B6DF0790B7552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 845KB
SHA256 7af70c2c2af8d05b29bce32e2f795b693bbd8148bf66666f33ee3367c9dab147
MD5 4a8cf7dd3a9f2d2259df8c2dba8cbf7b
SHA1 eacb41137717ddda290586099d2ea7bf1f38c599
SHA512 80cb5881800266b2407dfed63d26488b480863884440488e9bd77396c982baaaa10901e3b9ce9b297e4d8c8ef7c2ee567d4935599387876f07903790d2d76469
SSDEEP 24576:CXY6X5czAdMamZxbsIgkj8KAoeU5pmV7ch79Q:25cAM5xbKkj8rBGGAh7
TLSH
T100050269B3E409F9ED6B823DCDA28506FA3378514770E78B03A49A251F233D85E3D752
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 826KB
SHA256 004bfd146e2927185d18003c21a4904acaf74532622cecd18a64e6bb70dff85f
MD5 b78de4bafb8312a8f7cabf5edaa4fd08
SHA1 4651bae398f26bc6b20ef9247a427bdee9d10c4d
SHA512 bb031be7ede8ee517f5d41cf2ac751aef6b0b44b155e0da84f1234b6ba63397163cc3ee78e8143ba2ad800bd6ba26d7de6d55e0311a682aa18e2f6f1210c8cbb
SSDEEP 24576:Qwu+OWSMamZxbsIgkj8KAoeU5pmV7ch79Q:QwlO1M5xbKkj8rBGGAh7
TLSH
T1AB05F18672A80CF9E5679239C557C536FBF3B8122A31DB0F0760C75A6F27361AD29720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 a0832c0863b264e39bde28dd8368fa81e185d37659acb1b219ded82dad8437d0
MD5 cad31396880128be8ccedf257943a172
SHA1 92215da2654bf15f4bfbde43e630c3f6f3146826
SHA512 03a22662860da95e2c479fcb4fa7a272a631cb633eeb749799432482cc7a7307da6fb37b316ac6076d07cfb174fddf5b91fd5b564e5a22712c86a13a03330ce1
SSDEEP 49152:PN+taZ3usBWOBr4tEGp0bqx0z+n217aau1glFM5xbKkj8rBGGAh7:du6JmTxd2dwhg0GAB
TLSH
T106D59D13F1DA01E8D06ED079974A9233EA62BC490B35B6DF0A9073552E77EE4AB3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 606KB
SHA256 e0db781f2d337a56e919861d1d8ef8500cf4051ceff067a943f442c8dc3c164b
MD5 1af509e962c6667cea3e98a56b8e7385
SHA1 b806f3a9e3cdb51064ac3e0355dc6054ab530205
SHA512 f13682ffaeff3611aa0c2f97b9e5cd6391dc8befb51e741908acb2c2ce6fff9b9979bc04abfa3e50501cd8226e99737ed3f76aa97c8f795650ef0075e0540d7c
SSDEEP 12288:BQ7Oycb7WLAlZxbEX9xq79m5h8jthoZ1gpAStyEeUDNpmV7cluTO79Q:mnMamZxbsIgkj8KAoeU5pmV7ch79Q
TLSH
T196D423C6D26D8719F17EA3738563891E3E2F7BB5BB32578B241417402C267E69E4034B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameInputSvc.exe

Path C:\Windows\System32\GameInputSvc.exe
Size 660KB
SHA256 5229ee36f1898b410fa26fc7550db054986f7658dd0125d4bc4169d3f9673838
MD5 64caf0d87aee76d6d6a5b3df87653e78
SHA1 8dd307729ec1acb51cb001180d3c8099407e29a3
SHA512 5748c03daffac547728c9af3386c820071bbfd26aa6dcac272b0ef605e443e0f5460904526f33129bbc2284a18e5070a8cd40c5fafbd61864183816f0bf4a471
SSDEEP 12288:pZGYXcb7WLAlZxbEX9xq79m5h8jthoZ1gpAStyEeUDNpmV7cluTO79Q:7GcMamZxbsIgkj8KAoeU5pmV7ch79Q
TLSH
T119E4229EA1BA6358C13FD33B8832991B7D7236B1A73627DF046096309F166F17630E46
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 624KB
SHA256 781feba56d2eca9cbff4e78afe0ebf6923364065cf783bbaeb891a7a09cc80f1
MD5 8968869f0568e321fda2e0ac5a851989
SHA1 4eb40d4f6d02199322932f16cd653961b93f9db2
SHA512 b7f169229d91e9a4d3e9c1a8e81c7faa19ed49125f552d0c997da724421622d5c1f2c8b0f5077713c34988fb5d3df7ff971b94a68f99524c2d493dccc9d2beb7
SSDEEP 12288:nVccb7WLAlZxbEX9xq79m5h8jthoZ1gpAStyEeUDNpmV7cluTO79Q:nqMamZxbsIgkj8KAoeU5pmV7ch79Q
TLSH
T1E0D423C5916D8319E26FA37785239D0F3E5A77B2B7332BC7242417002D1A6F7AA70297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 828KB
SHA256 e78bba8af3bf957324cf2744b8c87aa8e424d2c00cea4cac2fd18c6a7150b86d
MD5 deaad8bb6b4568508ee0bf102097d72f
SHA1 0780b8df29d40e96f9a31620d5d7fd13f409ffc3
SHA512 4ce95f2b1e8c4f2f295d567f4a92f0130f3dd018a843bde3d05c2c078b1e67e584a7f46c4e1b6374b6f94d288de8807d3547968b770371a62356d8653f56b712
SSDEEP 24576:kPUr+NQ2oMamZxbsIgkj8KAoeU5pmV7ch79Q:kJQ5M5xbKkj8rBGGAh7
TLSH
T1A505F25F62AD18E5E67AE17D8942870DF7727462131293CF02A0817E1F27EE8BD39711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.7MB
SHA256 00f6f79438603d4126f67d4e549b3f8c21b3cbadd5192c4da83a4b304639f2bd
MD5 068df29deaa642fc1ea4b600b8325532
SHA1 c6b20af6ecfc5cb807163185a7f532e11b090b82
SHA512 f705dcaca51ba0b439618bc069e4d823cbedcd9109d053d14ce55d11dbad1fd3f5c5e6f1a45a2e0a7896c9c68d1893abcc6cd1de95cf4d89022555a39cf6520d
SSDEEP 49152:1BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjqM5xbKkj8rBGGAh7:+G05lO43b6hg0GAB
TLSH
T11FD5CF6A62EC11F9D1BBD17CCAC64A0BEBB23415033556CF02A486A91F27FF4597E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 776KB
SHA256 0ffa1363ede6ab47d141f38c80b887daf0e16f004ff676b08f42da519547a1c0
MD5 f18aba32c137e693797878b0e71cfbc4
SHA1 84852dcf54c89d8a39193273f8615e17f8dc43e3
SHA512 ac04805a396d9b24a51bd284ffa84f0ae86d651d8b7c6943bb111d5504d4e9a5e46128e89fe7e6367e9dbe8c58b0c94a8cdf2c1fdaf5e95f56fc19157fb584c6
SSDEEP 24576:e6DIpMamZxbsIgkj8KAoeU5pmV7ch79Q:e6DIpM5xbKkj8rBGGAh7
TLSH
T1CEF4024D637A11F9D17BD03FC6930506E6B2B1B1D3221ACF0694C6795FA3ED8B938A42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 760KB
SHA256 653758191a6ee24c9b7c4e277749f26be5a11b90492818be5c164a99bbb4a086
MD5 982e55f7d613d8e6be0bbc39914ad5bb
SHA1 e21dc8cc9acc4ee753daaca53f659dfd0d92308b
SHA512 8ff6f14074b1571725318ca1bd8550bab2e54a5256e9c24a9ecbd0ef6997d8556905fd8d2c5850b661ecb6879296f36b3b1a29563e8f0ec981613e7f10c680c2
SSDEEP 12288:DG6ky3jcb7WLAlZxbEX9xq79m5h8jthoZ1gpAStyEeUDNpmV7cluTO79Q:StyzMamZxbsIgkj8KAoeU5pmV7ch79Q
TLSH
T15EF4234593A85298E2BE5336CA738515AE36BD30AB3257CF1460A72D2F367E1BD30707
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/480-1-0x000001F6357D0000-0x000001F635836000-memory.dmp

Download

memory/480-19-0x000001F6357D0000-0x000001F635836000-memory.dmp

Download

memory/480-0-0x00007FF620B00000-0x00007FF620C1F000-memory.dmp

Download

memory/480-3-0x000001F6357D0000-0x000001F635836000-memory.dmp

Download

memory/480-22-0x00007FF620B00000-0x00007FF620C1F000-memory.dmp

Download

memory/1856-43-0x00007FF779790000-0x00007FF7798F7000-memory.dmp

Download

memory/1856-44-0x0000020DC09D0000-0x0000020DC0A36000-memory.dmp

Download

memory/1856-45-0x0000020DC09D0000-0x0000020DC0A36000-memory.dmp

Download

memory/1856-50-0x0000020DC09D0000-0x0000020DC0A36000-memory.dmp

Download

memory/1856-52-0x00007FF779790000-0x00007FF7798F7000-memory.dmp

Download

memory/1992-37-0x00000177E1630000-0x00000177E1696000-memory.dmp

Download

memory/1992-36-0x00000177E1630000-0x00000177E1696000-memory.dmp

Download

memory/1992-34-0x00000177E1430000-0x00000177E1508000-memory.dmp

Download

memory/1992-35-0x00000177E1630000-0x00000177E1696000-memory.dmp

Download

memory/2108-261-0x00007FF618190000-0x00007FF6182D9000-memory.dmp

Download

memory/2108-263-0x00000240804F0000-0x0000024080556000-memory.dmp

Download

memory/2108-264-0x00000240804F0000-0x0000024080556000-memory.dmp

Download

memory/2292-249-0x00007FF7A1DB0000-0x00007FF7A1EC9000-memory.dmp

Download

memory/2292-250-0x000001EE76B60000-0x000001EE76BC6000-memory.dmp

Download

memory/2292-251-0x000001EE76B60000-0x000001EE76BC6000-memory.dmp

Download

memory/2800-288-0x00007FF637680000-0x00007FF637DC3000-memory.dmp

Download

memory/2800-283-0x000002033DAA0000-0x000002033DB06000-memory.dmp

Download

memory/2800-282-0x000002033DAA0000-0x000002033DB06000-memory.dmp

Download

memory/3896-61-0x00007FF726560000-0x00007FF726682000-memory.dmp

Download

memory/3896-13-0x0000025EBBDD0000-0x0000025EBBE36000-memory.dmp

Download

memory/3896-14-0x0000025EBBDD0000-0x0000025EBBE36000-memory.dmp

Download

memory/3896-12-0x0000025EBBDD0000-0x0000025EBBE36000-memory.dmp

Download

memory/3896-11-0x00007FF726560000-0x00007FF726682000-memory.dmp

Download

memory/4416-234-0x0000020176FE0000-0x0000020177046000-memory.dmp

Download

memory/4416-232-0x0000020176FE0000-0x0000020177046000-memory.dmp

Download

memory/4416-233-0x00007FF728AB0000-0x00007FF728B78000-memory.dmp

Download

memory/4480-244-0x00000271FC8B0000-0x00000271FC916000-memory.dmp

Download

memory/4480-243-0x00000271FC8B0000-0x00000271FC916000-memory.dmp

Download

memory/4480-241-0x00007FF728AB0000-0x00007FF728B78000-memory.dmp

Download

memory/4600-276-0x0000000000810000-0x0000000000879000-memory.dmp

Download

memory/4600-271-0x0000000000810000-0x0000000000879000-memory.dmp

Download

memory/4600-270-0x0000000000400000-0x00000000004AD000-memory.dmp

Download

memory/5172-290-0x00007FF7027D0000-0x00007FF70287D000-memory.dmp

Download

memory/5172-291-0x00000242D2080000-0x00000242D20E6000-memory.dmp

Download

memory/5172-292-0x00000242D2080000-0x00000242D20E6000-memory.dmp

Download

memory/5336-26-0x0000027BA90C0000-0x0000027BA9126000-memory.dmp

Download

memory/5336-25-0x0000027BA8F90000-0x0000027BA9068000-memory.dmp

Download

memory/5336-28-0x0000027BA90C0000-0x0000027BA9126000-memory.dmp

Download

memory/5504-56-0x00000217A9C70000-0x00000217A9CD6000-memory.dmp

Download

memory/5504-57-0x00000217A9C70000-0x00000217A9CD6000-memory.dmp

Download

memory/5504-55-0x00000217A9A40000-0x00000217A9B18000-memory.dmp

Download